-
Notifications
You must be signed in to change notification settings - Fork 0
Expand file tree
/
Copy pathblog-security-malware.html
More file actions
681 lines (587 loc) · 51.4 KB
/
Copy pathblog-security-malware.html
File metadata and controls
681 lines (587 loc) · 51.4 KB
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
370
371
372
373
374
375
376
377
378
379
380
381
382
383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
415
416
417
418
419
420
421
422
423
424
425
426
427
428
429
430
431
432
433
434
435
436
437
438
439
440
441
442
443
444
445
446
447
448
449
450
451
452
453
454
455
456
457
458
459
460
461
462
463
464
465
466
467
468
469
470
471
472
473
474
475
476
477
478
479
480
481
482
483
484
485
486
487
488
489
490
491
492
493
494
495
496
497
498
499
500
501
502
503
504
505
506
507
508
509
510
511
512
513
514
515
516
517
518
519
520
521
522
523
524
525
526
527
528
529
530
531
532
533
534
535
536
537
538
539
540
541
542
543
544
545
546
547
548
549
550
551
552
553
554
555
556
557
558
559
560
561
562
563
564
565
566
567
568
569
570
571
572
573
574
575
576
577
578
579
580
581
582
583
584
585
586
587
588
589
590
591
592
593
594
595
596
597
598
599
600
601
602
603
604
605
606
607
608
609
610
611
612
613
614
615
616
617
618
619
620
621
622
623
624
625
626
627
628
629
630
631
632
633
634
635
636
637
638
639
640
641
642
643
644
645
646
647
648
649
650
651
652
653
654
655
656
657
658
659
660
661
662
663
664
665
666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
<!DOCTYPE html>
<html lang="sr">
<head>
<meta charset="UTF-8">
<meta name="viewport" content="width=device-width, initial-scale=1.0">
<title>Website Malware & Backdoors — Detection Guide / Malware i Webshell napadi — Kako ih prepoznati · Backdoors · Defacement</title>
<meta name="description" content="Complete guide to website malware, webshells, SEO spam, backdoor attacks, cryptojacking, and phishing. Learn how attackers compromise sites and how to detect indicators of compromise. · Kompletni vodic za website malware: webshell backdoor-ovi, SEO spam, cryptojacking, phishing, JS obfuscation i kako ih detektovati.">
<meta name="keywords" content="website malware, webshell, backdoor, SEO spam, phishing, cryptojacking, URLhaus, OpenPhish, js obfuscation, hakovan sajt, malware skener, Magecart, skimmer, drive-by download, DNSBL, blacklist, Google Safe Browsing, malware detekcija, website security, c99shell, b374k, WSO shell, eval base64, japanese keyword hack, index contamination, malware removal, web application firewall, WAF">
<meta name="robots" content="index, follow, max-snippet:-1, max-image-preview:large">
<link rel="canonical" href="https://security-skener.gradovi.rs/blog-security-malware.html">
<link rel="alternate" hreflang="sr" href="https://security-skener.gradovi.rs/blog-security-malware.html">
<link rel="alternate" hreflang="x-default" href="https://security-skener.gradovi.rs/blog-security-malware.html">
<meta property="og:type" content="article">
<meta property="og:title" content="Website Malware & Backdoors / Malware i Webshell napadi — Vodic za detekciju">
<meta property="og:description" content="Complete guide to website malware: webshells, SEO spam, cryptojacking, phishing, JS obfuscation. · Kompletni vodic za malware na sajtovima: backdoor-ovi, SEO spam, cryptojacking, phishing.">
<meta property="og:url" content="https://security-skener.gradovi.rs/blog-security-malware.html">
<meta property="og:locale" content="sr_RS">
<meta property="og:locale:alternate" content="en_US">
<meta name="twitter:card" content="summary_large_image">
<meta name="twitter:title" content="Website Malware & Backdoors / Malware i Webshell napadi">
<meta name="twitter:description" content="Webshells, SEO spam, cryptojacking, phishing — how to detect them. · Webshell-ovi, SEO spam, cryptojacking, phishing — kako ih detektovati.">
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "Article",
"headline": "Malware i Webshell napadi — Kako ih prepoznati i detektovati",
"author": {"@type": "Person", "name": "Toske", "url": "https://toske-programer.web.app"},
"publisher": {"@type": "Organization", "name": "Web Security Scanner"},
"datePublished": "2026-04-15",
"dateModified": "2026-04-17",
"description": "Complete guide to website malware: webshells, backdoors, SEO spam, cryptojacking, phishing, JS obfuscation and detection methods. · Kompletni vodic za malware: webshell-ovi, backdoor-ovi, SEO spam, cryptojacking, phishing, JS obfuscation i metode detekcije.",
"inLanguage": ["sr-RS", "en-US"],
"keywords": "website malware, webshell, backdoor, SEO spam, phishing, cryptojacking, malware detekcija, hakovan sajt",
"mainEntityOfPage": {
"@type": "WebPage",
"@id": "https://security-skener.gradovi.rs/blog-security-malware.html"
}
}
</script>
<script type="application/ld+json">
{
"@context": "https://schema.org",
"@type": "FAQPage",
"mainEntity": [
{
"@type": "Question",
"name": "Sta je website malware?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Website malware je maliciozni kod ubacen na vas sajt koji zloupotrebljava resurse servera ili podatke posetilaca. Najcesci oblici su webshell backdoor-ovi, SEO spam injekcije, JavaScript skimmeri (Magecart), cryptojacking skripte i phishing stranice. Prema Sucuri izvestaju, preko 30.000 sajtova biva hakovano svakog dana."
}
},
{
"@type": "Question",
"name": "Kako hakeri ubacuju malware na sajt?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Najcesci vektori napada su: zastareli CMS pluginovi sa poznatim ranjivostima (preko 50% slucajeva), kompromitovane admin lozinke (brute-force ili credential stuffing), nezasticene upload forme koje dozvoljavaju PHP fajlove, SQL injection kroz nevalidirane inpute, i supply-chain napadi kroz kompromitovane biblioteke."
}
},
{
"@type": "Question",
"name": "Koliko dugo malware moze ostati nedetektovan?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Prosecno vreme detekcije (dwell time) je oko 90 dana prema Sucuri Annual Website Threat Report-u. Napredni napadaci koriste obfuskovane webshell-ove i spavajuce backdoor-e koji se aktiviraju tek posle odredjenog perioda, sto dodatno otezava detekciju."
}
},
{
"@type": "Question",
"name": "Da li Google moze da detektuje malware na mom sajtu?",
"acceptedAnswer": {
"@type": "Answer",
"text": "Da. Google Safe Browsing skenira milijarde URL-ova dnevno i prikazuje crveno upozorenje posetiocima zarazenih sajtova. Medjutim, Google detektuje samo oko 60-70% infekcija i sa zakasnjenjem od nekoliko dana do nedelja. Zato su potrebni specijalizovani malware skeneri za proaktivnu detekciju."
}
}
]
}
</script>
<link rel="icon" type="image/svg+xml" href="/favicon.svg">
<link href="https://fonts.googleapis.com/css2?family=Inter:wght@400;600;700;800&display=swap" rel="stylesheet">
<link rel="stylesheet" href="./blog-common.css">
</head>
<body>
<div class="blog-layout">
<aside class="timeline-nav">
<div class="sr">
<div class="timeline-title">Sadržaj</div>
<ol id="timeline-sr"></ol>
</div>
<div class="en">
<div class="timeline-title">Contents</div>
<ol id="timeline-en"></ol>
</div>
</aside>
<main class="blog-content">
<!-- ==================== SRPSKI ==================== -->
<div class="sr">
<h1>Malware na sajtovima — Kako prepoznati i zastititi se</h1>
<p class="subtitle">Kompletni vodic za vlasnike sajtova: sta je website malware, kako prepoznati da je vas sajt zarazen, koje su posledice, i kako se efikasno zastititi.</p>
<div class="stat-grid">
<div class="stat-card"><div class="stat-num">30k+</div><div class="stat-label">Sajtova hakovano dnevno</div></div>
<div class="stat-card"><div class="stat-num">4-6</div><div class="stat-label">Backdoor-ova po napadu</div></div>
<div class="stat-card"><div class="stat-num">73%</div><div class="stat-label">Napada koristi SEO spam</div></div>
<div class="stat-card"><div class="stat-num">~90</div><div class="stat-label">Dana do detekcije</div></div>
</div>
<div class="toc">
<h3>Sadrzaj</h3>
<ol>
<li><a href="#mw1">Sta je website malware</a></li>
<li><a href="#mw2">Simptomi zaraze — kako prepoznati da ste kompromitovani</a></li>
<li><a href="#mw3">Tipovi pretnji sa kojima se vlasnici sajtova suocavaju</a></li>
<li><a href="#mw4">Posledice po reputaciju i poslovanje</a></li>
<li><a href="#mw5">Prevencija — kako zastititi sajt pre nego sto se ista desi</a></li>
<li><a href="#mw6">Redovno skeniranje i monitoring</a></li>
<li><a href="#mw7">Blackliste — sta su i kako se skinuti sa njih</a></li>
<li><a href="#mw8">Kako nas skener pomaze u detekciji</a></li>
<li><a href="#mw9">Statistike i zasto je ovo vazno</a></li>
<li><a href="#mw10">Reference i korisni resursi</a></li>
</ol>
</div>
<h2 id="mw1">1. Sta je website malware</h2>
<p>Website malware je maliciozni kod koji se pojavi na vasem sajtu bez vaseg znanja. Ne mora da zarazi kompjutere posetilaca na klasican nacin — u vecini slucajeva zloupotrebljava resurse vaseg servera i stetno utice na vase posetoce, vasu reputaciju i vase poslovanje.</p>
<p>Posledice po vlasnika sajta mogu biti:</p>
<ul>
<li><strong>Kradja podataka posetilaca</strong> — Licni podaci, kreditne kartice i lozinke vase musterije mogu biti presretnuti bez vaseg znanja.</li>
<li><strong>Zloupotreba vaseg servera</strong> — Vas server moze slati hiljade spam emailova, sto dovodi do blacklist-ovanja vase adrese.</li>
<li><strong>Preusmeravanje posetilaca</strong> — Umesto vaseg sadrzaja, posetioci vide prevare, phishing forme ili reklame za sumnjive proizvode.</li>
<li><strong>Kontaminacija Google indeksa</strong> — Vas sajt pocinje da se rangira za reci koje nemaju veze sa vasim poslovanjem (farmacija, kockanje, luksuzna roba).</li>
<li><strong>Zloupotreba resursa</strong> — Procesori posetilaca se koriste za rudarenje kriptovaluta, sto usporava njihov racunar.</li>
</ul>
<p>Prema Sucuri Annual Website Threat Report-u za 2024, preko 30.000 sajtova biva hakovano svakog dana, a prosecno vreme od zaraze do detekcije je oko 90 dana. To znaci da vecina vlasnika ne zna da ima problem — mesecima.</p>
<div class="callout">
<strong>Kljucna poruka:</strong> Website malware nije problem koji pogadja samo velike kompanije. Mali biznisi, blogovi i licni sajtovi su najcesci targeti upravo zato sto obicno imaju slabiju zastitu i nikada ne ocekuju napad.
</div>
<h2 id="mw2">2. Simptomi zaraze — kako prepoznati da ste kompromitovani</h2>
<p>Sto ranije uocite problem, manja je steta. Ovo su najcesci simptomi koje vlasnici sajtova primete:</p>
<h3>Simptomi vidljivi u browseru</h3>
<ul>
<li><strong>Google crveni ekran</strong> — Posetiocima se prikazuje upozorenje "Deceptive site ahead" ili "This site may harm your computer" umesto vaseg sadrzaja.</li>
<li><strong>Neocekivana preusmeravanja</strong> — Klik na bilo koji link na vasem sajtu vodi na potpuno drugi sajt (farmacija, kockanje, lazne nagradne igre).</li>
<li><strong>Nepoznat sadrzaj</strong> — Na vasim stranicama se pojavljuju reklame, pop-up prozori ili tekstovi koje vi niste postavili.</li>
<li><strong>Sajt je izuzetno spor</strong> — Procesori posetilaca se opterecuju skrivenim skriptama, ventilator na laptopu radi na maksimumu.</li>
</ul>
<h3>Simptomi vidljivi u Google Search Console</h3>
<ul>
<li><strong>Security Issues tab</strong> — Google vas direktno obavestavava da je pronasao malware ili phishing sadrzaj.</li>
<li><strong>Neocekivane stranice u indeksu</strong> — U Coverage izvestaju vidite hiljade stranica koje vi nikada niste kreirali, cesto na stranim jezicima.</li>
<li><strong>Nagli pad prometa</strong> — Organski promet pada 50-90% jer Google sklanja vas sajt iz rezultata pretrage.</li>
</ul>
<h3>Simptomi vidljivi na serveru</h3>
<ul>
<li><strong>Nepoznati fajlovi</strong> — U hosting kontrolnom panelu (cPanel/Plesk) vidite fajlove koje niste vi postavili, posebno u uploads folderima.</li>
<li><strong>Modifikovani sistemski fajlovi</strong> — Datum izmene kljucnih fajlova (<code>index.php</code>, <code>.htaccess</code>) se ne poklapa sa vasom poslednjom izmenom.</li>
<li><strong>Visoka potrosnja resursa</strong> — Hosting vam javlja da prekoracujete CPU ili bandwidth limit iako niste menjali nista na sajtu.</li>
<li><strong>Emailovi idu u spam</strong> — Vasi legitimni emailovi pocnu da zavrsavaju u spam folderima primalaca jer je vas server na email blacklisti.</li>
</ul>
<div class="callout callout-warn">
<strong>Vazno:</strong> Ako primetite bilo koji od ovih simptoma, nemojte ignorisati — problem se nece resiti sam od sebe. Sto duze ostane nezarazen, vise stete trpite: gubitak posetilaca, gubitak reputacije, potencijalne pravne posledice.
</div>
<h2 id="mw3">3. Tipovi pretnji sa kojima se vlasnici sajtova suocavaju</h2>
<p>Razumevanje pretnji pomaze vam da znate od cega se stitite. Evo pregled najcescih tipova malware-a sa stanovista vlasnika sajta:</p>
<table>
<tr><th>Pretnja</th><th>Sta se desava vasem sajtu</th><th>Kako je prepoznajete</th><th>Ozbiljnost</th></tr>
<tr><td>Backdoor (Webshell)</td><td>Neko ima trajni pristup vasem serveru cak i posle promene lozinki</td><td>Nepoznati fajlovi na serveru, ponavljajuci napadi posle cistenja</td><td>Kriticna</td></tr>
<tr><td>SEO Spam</td><td>Google indeksira hiljade laznih stranica na vasem domenu</td><td>Stranice na stranim jezicima u Search Console, pad prometa</td><td>Visoka</td></tr>
<tr><td>JavaScript Skimer</td><td>Podaci posetilaca (kartice, lozinke) se presrecu</td><td>Prituzbe kupaca, neocekivane spoljne konekcije</td><td>Kriticna</td></tr>
<tr><td>Cryptojacking</td><td>Procesori posetilaca se koriste za rudarenje kripto valuta</td><td>Spor sajt, visok CPU kod posetilaca, ventilatori na maksimumu</td><td>Srednja</td></tr>
<tr><td>Phishing stranice</td><td>Na vasem domenu se nalaze lazne login forme za banke/servise</td><td>Google upozorenje, obavest od hosting provajdera</td><td>Kriticna</td></tr>
<tr><td>Spam Relay</td><td>Vas server salje hiljade spam emailova</td><td>Email na blacklisti, hosting upozorenje o prekoracenju</td><td>Visoka</td></tr>
<tr><td>Defacement</td><td>Vas sajt je vizuelno izmenjen (politicka poruka, grafiti)</td><td>Odmah vidljivo — sadrzaj vaseg sajta je promenjen</td><td>Srednja</td></tr>
</table>
<div class="callout">
<strong>Najcesci scenario:</strong> Prema Sucuri izvestaju, 73% svih infekcija ukljucuje SEO spam. Vlasnik cesto ne primeti nista jer su lazne stranice skrivene od obicnih posetilaca — vide ih samo search engine botovi (tehnika poznata kao cloaking). Zato je redovno proveravanje Google indeksa vaseg sajta kljucno.
</div>
<h2 id="mw4">4. Posledice po reputaciju i poslovanje</h2>
<p>Malware infekcija nije samo tehnicki problem — to je poslovna kriza koja pogadja vise aspekata odjednom:</p>
<h3>Google blacklist i gubitak prometa</h3>
<p>Kada Google Safe Browsing oznaci vas sajt, svi veliki browseri (Chrome sa 65% trzista, Firefox, Safari, Edge) prikazuju crveni ekran umesto vaseg sadrzaja. Istrazivanja pokazuju da 95% posetilaca napusta sajt cim vidi ovo upozorenje — i vecina se nikada ne vrati.</p>
<h3>Email problemi</h3>
<p>Ako vas server zavrsava na email blacklistama (Spamhaus, Barracuda, URIBL), vasi legitimni poslovni emailovi — ponude, fakture, potvrde — zavrsavaju u spam folderima klijenata. Cak i posle cistenja, moze potrajati nedeljama da se reputacija vaseg domena potpuno oporavi.</p>
<h3>Gubitak poverenja kupaca</h3>
<p>Ako se pronade da je vas sajt servirao malware ili da su podaci kupaca procureli, to poverenje je izuzetno tesko vratiti. U eri online recenzija, jedna bezbednosna infekcija moze ostaviti trajni trag na vasem poslovnom ugledu.</p>
<h3>Pravne posledice</h3>
<p>Prema GDPR-u (Clan 32), vlasnici sajtova su duzni da primene "odgovarajuce tehnicke mere" za zastitu licnih podataka. Ako se dokaze da infekcija nastala zbog zanemarene bezbednosti, kazne mogu ici do 20 miliona EUR ili 4% globalnog prihoda. Srpski Zakon o zastiti podataka o licnosti (ZZPL) ima slicne odredbe.</p>
<h3>Troskovi oporavka</h3>
<p>Profesionalno ciscenje sajta kosta od 200 do 1000+ EUR zavisno od ozbiljnosti. Dodajte na to gubitak prihoda tokom nedostupnosti, troskove forenzicke analize, i vreme za obnovu reputacije — ukupna cena infekcije cesto premasi 5.000 EUR za mali biznis.</p>
<h2 id="mw5">5. Prevencija — kako zastititi sajt pre nego sto se ista desi</h2>
<p>Prevencija je uvek jeftinija i jednostavnija od oporavka. Evo konkretnih koraka koje svaki vlasnik sajta moze preduzeti:</p>
<h3>Azuriranje softvera</h3>
<p>Preko 50% svih infekcija dolazi kroz zastareli CMS ili plugin. Obavezno:</p>
<ul>
<li>Ukljucite automatska azuriranja za WordPress core, teme i pluginove</li>
<li>Redovno proveravajte da li koristite najnoviju verziju PHP-a na serveru</li>
<li>Obrisite sve neaktivne pluginove i teme — cak i deaktivirani plugin moze biti ranjiv</li>
<li>Pratite sigurnosna obavestenja za softver koji koristite (WordPress security mailing lista, plugin changelog-ovi)</li>
</ul>
<h3>Jake lozinke i dvofaktorska autentifikacija (2FA)</h3>
<ul>
<li>Koristite lozinke od minimum 16 karaktera sa mesavinom slova, brojeva i specijalnih znakova</li>
<li>Nikada ne koristite istu lozinku na vise sajtova — koristite password manager (Bitwarden, 1Password)</li>
<li>Obavezno aktivirajte 2FA za admin panel, hosting kontrolni panel, FTP i SSH pristup</li>
<li>Promenite podrazumevano admin korisnicko ime (<code>admin</code>) u nesto jedinstveno</li>
</ul>
<h3>Web Application Firewall (WAF)</h3>
<p>WAF je kao zastitni zid ispred vaseg sajta koji filtrira maliciozni saobracaj pre nego sto stigne do vaseg servera. Preporucene opcije:</p>
<ul>
<li><strong>Cloudflare</strong> — Besplatan plan sa osnovnom WAF zastitom, placeni planovi sa naprednijim pravilima</li>
<li><strong>Sucuri Firewall</strong> — Specijalizovan za WordPress, ukljucuje i CDN i DDoS zastitu</li>
<li><strong>Wordfence</strong> — WordPress plugin sa ugradjenim firewall-om i malware skenerom</li>
</ul>
<h3>Backup strategija</h3>
<p>Backup vas nece spreciti od napada, ali ce vam omoguciti brz oporavak:</p>
<ul>
<li>Pravite dnevne backup-e (fajlovi + baza podataka)</li>
<li>Cuvajte backup na <strong>odvojenom mestu</strong> od servera (cloud storage, lokalni disk)</li>
<li>Zadrzite bar 30 dana istorije backup-a — infekcija moze biti prisutna nedeljama pre detekcije</li>
<li>Redovno testirajte restore proceduru — backup koji ne mozete da vratite je beskoristan</li>
</ul>
<h3>Bezbednosna konfiguracija servera</h3>
<pre><code># .htaccess zastita za WordPress upload folder
# Sprecava izvrsavanje skripti u uploads direktorijumu
<Directory "/var/www/html/wp-content/uploads">
<FilesMatch "\.(php|phtml|php3|php4|php5|pl|py|cgi)$">
Require all denied
</FilesMatch>
</Directory>
# Sakrijte verziju WordPress-a
remove_action('wp_head', 'wp_generator');
# Ogranicite pristup wp-admin po IP adresi
<Files wp-login.php>
Require ip 123.456.789.0/24
</Files></code></pre>
<div class="callout">
<strong>Minimalni bezbednosni checklist:</strong> (1) Azurirani CMS i pluginovi, (2) Jake lozinke + 2FA, (3) WAF ukljucen, (4) Dnevni backup na odvojenom mestu, (5) Onemoguceno izvrsavanje skripti u upload folderima. Ovih 5 koraka sprecava preko 90% napada.
</div>
<h2 id="mw6">6. Redovno skeniranje i monitoring</h2>
<p>Zastita nije jednokratna radnja — to je kontinuiran proces. Redovno skeniranje vaseg sajta je jedini nacin da budete sigurni da je sve u redu.</p>
<h3>Sta treba da skenirate i koliko cesto</h3>
<table>
<tr><th>Provera</th><th>Ucestalost</th><th>Alat</th></tr>
<tr><td>Spoljni malware sken (frontend analiza)</td><td>Nedeljno</td><td>Nas Malware Scanner, Sucuri SiteCheck</td></tr>
<tr><td>Google Search Console — Security Issues</td><td>Nedeljno</td><td>Google Search Console (besplatno)</td></tr>
<tr><td>Google indeks provera (<code>site:vas-domen.rs</code>)</td><td>Mesecno</td><td>Google pretraga</td></tr>
<tr><td>Blacklist provera (DNSBL, Spamhaus)</td><td>Nedeljno</td><td>Nas skener, MXToolbox</td></tr>
<tr><td>SSL sertifikat status</td><td>Mesecno</td><td>Nas skener, SSL Labs</td></tr>
<tr><td>Integritet fajlova na serveru</td><td>Dnevno (automatski)</td><td>Wordfence, Imunify360, OSSEC</td></tr>
<tr><td>CMS i plugin azuriranja</td><td>Nedeljno</td><td>WordPress dashboard, hosting panel</td></tr>
</table>
<h3>Automatski monitoring servisi</h3>
<p>Za vlasnika sajta koji nema vremena da rucno proverava svake nedelje, postoje servisi koji to rade automatski i salju upozorenje ako nesto ne valja:</p>
<ul>
<li><strong>UptimeRobot</strong> (besplatan) — Proverava da li je vas sajt online svakih 5 minuta i obavestavava vas ako padne</li>
<li><strong>Google Search Console</strong> (besplatan) — Salje email upozorenje ako Google pronadje bezbednosni problem</li>
<li><strong>Wordfence</strong> (besplatan plan) — WordPress plugin koji skenira fajlove i salje upozorenje na email</li>
<li><strong>Sucuri</strong> (placen) — Kontinuirani monitoring + automatsko ciscenje ako se pronadje problem</li>
</ul>
<div class="callout callout-warn">
<strong>Ne oslanjajte se samo na Google:</strong> Google Safe Browsing detektuje oko 60-70% infekcija i to sa zakasnjenjem od nekoliko dana. Redovan spoljni sken specijalizovanim alatom otkriva probleme koje Google propusti ili jos nije indeksirao.
</div>
<h2 id="mw7">7. Blackliste — sta su i kako se skinuti sa njih</h2>
<p>Kada vas sajt bude kompromitovan, razliciti bezbednosni servisi ga nezavisno stavljaju na crne liste. To pokrecete domino efekat koji pogadja vise aspekata vaseg prisustva na internetu.</p>
<h3>Glavne blackliste i njihov uticaj</h3>
<table>
<tr><th>Servis</th><th>Uticaj na vas</th><th>Kako proveriti</th><th>Procedura uklanjanja</th></tr>
<tr><td>Google Safe Browsing</td><td>Crveni ekran u svim velikim browserima</td><td>Google Search Console → Security Issues</td><td>Fix + Review Request (24-72h)</td></tr>
<tr><td>Spamhaus (SBL/XBL)</td><td>Vasi emailovi idu u spam</td><td>Spamhaus Lookup na njihovom sajtu</td><td>Zahtev za uklanjanje + dokaz o cistenju</td></tr>
<tr><td>SURBL / URIBL</td><td>Linkovi ka vasem sajtu blokirani u emailovima</td><td>SURBL Lookup</td><td>Automatski 7-14 dana posle cistenja</td></tr>
<tr><td>PhishTank</td><td>Browser upozorenja za phishing</td><td>PhishTank pretraga</td><td>Automatski posle uklanjanja phishing sadrzaja</td></tr>
<tr><td>URLhaus (abuse.ch)</td><td>Blokirano od strane security alata</td><td>URLhaus pretraga</td><td>Prijava za uklanjanje na sajtu</td></tr>
<tr><td>VirusTotal</td><td>Negativna ocena kod 70+ AV vendora</td><td>VirusTotal URL sken</td><td>Rescan nakon cistenja</td></tr>
</table>
<h3>Procedura za uklanjanje sa Google blacklist-e</h3>
<ol>
<li><strong>Ocistite sajt</strong> — Potpuno uklonite sav maliciozni sadrzaj (ili angazujte profesionalca)</li>
<li><strong>Otvorite Google Search Console</strong> — Idite na Security Issues tab</li>
<li><strong>Oznacite "I have fixed these issues"</strong> — i posaljite Request a Review</li>
<li><strong>Sacekajte 24-72h</strong> — Google ce reskenirati vas sajt i ukloniti upozorenje ako je sve cisto</li>
<li><strong>Pratite narednih 30 dana</strong> — Proveravajte da se problem ne vraca (sto je znak da niste zatvorili ulaznu tacku)</li>
</ol>
<div class="callout">
<strong>Nas skener pomaze:</strong> Malware Scanner automatski proverava vas domen i IP adresu kroz Spamhaus, SURBL, URIBL, Barracuda i 10+ DNSBL lista u realnom vremenu. Jedna pozitivna detekcija znaci da morate hitno reagovati.
</div>
<h2 id="mw8">8. Kako nas skener pomaze u detekciji</h2>
<p>Nas Malware Scanner je dizajniran kao alat za vlasnike sajtova koji zele brzu i besplatnu proveru bezbednosti. Evo sta proveravamo:</p>
<h3>Safe Scan (bez verifikacije — brza provera)</h3>
<ul>
<li><strong>HTML analiza</strong> — Proveravamo sadrzaj vaseg sajta za poznate indikatore infekcije</li>
<li><strong>JavaScript analiza</strong> — Trazimo sumnjive obrasce u skriptama koji ukazuju na skimmere ili cryptojacking</li>
<li><strong>Skriveni iframe-ovi</strong> — Detektujemo nevidljive elemente koji ucitavaju spoljni sadrzaj</li>
<li><strong>Link analiza</strong> — Proveravamo sve linkove na vasoj stranici protiv URLhaus i OpenPhish baza poznatih pretnji</li>
<li><strong>Cookie i tracker provera</strong> — Otkrivamo sumnjive tracking piksele i nepoznate cookie domene</li>
</ul>
<h3>Full Scan (zahteva verifikaciju vlasnistva)</h3>
<ul>
<li><strong>DNSBL provera</strong> — Proveravamo vasu IP adresu kroz 15+ blacklist baza u realnom vremenu</li>
<li><strong>Index Contamination</strong> — Analiziramo Google indeks za SEO spam (lazne stranice na stranim jezicima)</li>
<li><strong>Wayback Machine poredjenje</strong> — Uporedjujemo trenutni sajt sa arhiviranim verzijama za detekciju neovlascenih izmena</li>
<li><strong>Reputation Score</strong> — Racunamo skor reputacije baziran na starosti domene, SSL statusu i blacklist prisustvu</li>
</ul>
<div class="callout callout-warn">
<strong>Ogranicenja naseg skenera:</strong> Mi smo spoljni (remote) alat — analiziramo ono sto je vidljivo iz browsera. Ne mozemo pristupiti vasem serveru, citati bazu podataka, niti skenirati fajl sistem. Za duboku analizu servera, koristite Imunify360, Wordfence ili ClamAV koji rade direktno na vasem hostingu.
</div>
<h2 id="mw9">9. Statistike i zasto je ovo vazno</h2>
<p>Website malware nije teorijski problem — to je svakodnevna realnost koja pogadja sajtove svih velicina:</p>
<table>
<tr><th>Metrika</th><th>Vrednost</th><th>Izvor</th></tr>
<tr><td>Sajtova hakovano dnevno</td><td>30.000+</td><td>Sucuri Annual Report 2024</td></tr>
<tr><td>WordPress infekcija medju CMS-ovima</td><td>96.2%</td><td>Sucuri 2024</td></tr>
<tr><td>Najcesci tip malware-a</td><td>SEO Spam (73%)</td><td>Sucuri Annual Report 2024</td></tr>
<tr><td>Prosecno vreme do detekcije</td><td>~90 dana</td><td>Sucuri / SiteLock</td></tr>
<tr><td>Troskovi oporavka za mali biznis</td><td>200 — 5.000+ EUR</td><td>Industriji prosek</td></tr>
<tr><td>Posetioci koji napuste sajt nakon Google upozorenja</td><td>95%</td><td>Google Transparency Report</td></tr>
<tr><td>Procena globalne stete od cybercrime-a</td><td>$10.5 triliona/god</td><td>Cybersecurity Ventures 2025</td></tr>
</table>
<h3>Zasto su mali sajtovi najcesca meta</h3>
<p>Veliki sajtovi imaju bezbednosne timove, WAF-ove i 24/7 monitoring. Mali biznisi i licni sajtovi obicno nemaju nista od toga. Za napadace, laksa meta sa manjim rizikom — zato automatizovani alati skeniraju milione sajtova trazeci zastareli software i slabe lozinke. Nije licno — to je igra brojeva.</p>
<div class="callout">
<strong>Dobra vest:</strong> Vecina napada je automatizovana i cilja poznate ranjivosti. To znaci da se 5 osnovnih koraka zastite (azuriranja, jake lozinke, 2FA, WAF, backup) stiti od preko 90% pretnji. Ne morate biti bezbednosni ekspert — samo morate biti odgovoran vlasnik sajta.
</div>
<h2 id="mw10">10. Reference i korisni resursi</h2>
<ul>
<li><a href="https://sucuri.net/reports/website-threat-report/" target="_blank">Sucuri Annual Website Threat Report</a> — Godisnji izvestaj o pretnjama za web sajtove</li>
<li><a href="https://www.wordfence.com/threat-intel/" target="_blank">Wordfence Threat Intelligence</a> — WordPress bezbednosna obavestenja i ranjivosti</li>
<li><a href="https://safebrowsing.google.com/" target="_blank">Google Safe Browsing</a> — Proverite da li je vas sajt na Google blacklisti</li>
<li><a href="https://search.google.com/search-console" target="_blank">Google Search Console</a> — Besplatan alat za pracenje bezbednosti i indeksiranja vaseg sajta</li>
<li><a href="https://www.virustotal.com/" target="_blank">VirusTotal</a> — Besplatna provera URL-a kroz 70+ antivirusa</li>
<li><a href="https://mxtoolbox.com/blacklists.aspx" target="_blank">MXToolbox Blacklist Check</a> — Proverite da li je vas domen/IP na email blacklistama</li>
<li><a href="https://www.cloudflare.com/waf/" target="_blank">Cloudflare WAF</a> — Web Application Firewall sa besplatnim planom</li>
<li><a href="https://owasp.org/www-project-web-security-testing-guide/" target="_blank">OWASP Web Security Testing Guide</a> — Otvoreni vodic za testiranje bezbednosti</li>
<li><a href="https://developer.mozilla.org/en-US/docs/Web/Security" target="_blank">MDN Web Security</a> — Mozilla-in vodic za web bezbednost</li>
</ul>
<a href="./malware.html" class="cta">Skenirajte vas sajt besplatno →</a>
</div>
<!-- ==================== ENGLISH ==================== -->
<div class="en">
<h1>Website Malware — How to Detect and Protect Yourself</h1>
<p class="subtitle">A complete guide for site owners: what website malware is, how to recognize infection, what the consequences are, and how to effectively protect your site.</p>
<div class="stat-grid">
<div class="stat-card"><div class="stat-num">30k+</div><div class="stat-label">Sites hacked daily</div></div>
<div class="stat-card"><div class="stat-num">4-6</div><div class="stat-label">Backdoors per attack</div></div>
<div class="stat-card"><div class="stat-num">73%</div><div class="stat-label">Attacks use SEO spam</div></div>
<div class="stat-card"><div class="stat-num">~90</div><div class="stat-label">Days to detect</div></div>
</div>
<div class="toc">
<h3>Table of Contents</h3>
<ol>
<li><a href="#en-mw1">What is website malware</a></li>
<li><a href="#en-mw2">Symptoms of infection — how to tell you've been compromised</a></li>
<li><a href="#en-mw3">Types of threats site owners face</a></li>
<li><a href="#en-mw4">Impact on reputation and business</a></li>
<li><a href="#en-mw5">Prevention — how to protect your site before anything happens</a></li>
<li><a href="#en-mw6">Regular scanning and monitoring</a></li>
<li><a href="#en-mw7">Blacklists — what they are and how to get removed</a></li>
<li><a href="#en-mw8">How our scanner helps with detection</a></li>
<li><a href="#en-mw9">Statistics and why this matters</a></li>
<li><a href="#en-mw10">References and useful resources</a></li>
</ol>
</div>
<h2 id="en-mw1">1. What is website malware</h2>
<p>Website malware is malicious code that appears on your site without your knowledge. It doesn't necessarily infect visitors' computers in the traditional sense — in most cases it abuses your server's resources and harms your visitors, your reputation, and your business.</p>
<p>Consequences for site owners include:</p>
<ul>
<li><strong>Visitor data theft</strong> — Personal data, credit cards, and passwords of your customers can be intercepted without your knowledge.</li>
<li><strong>Server abuse</strong> — Your server may send thousands of spam emails, causing your address to be blacklisted.</li>
<li><strong>Visitor redirects</strong> — Instead of your content, visitors see scams, phishing forms, or ads for suspicious products.</li>
<li><strong>Google index contamination</strong> — Your site starts ranking for keywords unrelated to your business (pharmaceuticals, gambling, luxury goods).</li>
<li><strong>Resource abuse</strong> — Visitors' processors are used for cryptocurrency mining, slowing down their computers.</li>
</ul>
<p>According to Sucuri's Annual Website Threat Report for 2024, over 30,000 websites are hacked every day, and the average time from infection to detection is about 90 days. This means most site owners don't even know they have a problem — for months.</p>
<div class="callout">
<strong>Key takeaway:</strong> Website malware doesn't only affect large companies. Small businesses, blogs, and personal sites are the most frequent targets precisely because they usually have weaker security and never expect an attack.
</div>
<h2 id="en-mw2">2. Symptoms of infection — how to tell you've been compromised</h2>
<p>The sooner you notice the problem, the less damage you'll suffer. Here are the most common symptoms site owners spot:</p>
<h3>Symptoms visible in the browser</h3>
<ul>
<li><strong>Google red screen</strong> — Visitors see a warning like "Deceptive site ahead" or "This site may harm your computer" instead of your content.</li>
<li><strong>Unexpected redirects</strong> — Clicking any link on your site leads to a completely different site (pharmacy, gambling, fake prize draws).</li>
<li><strong>Unknown content</strong> — Ads, pop-ups, or texts appear on your pages that you never placed there.</li>
<li><strong>Extremely slow site</strong> — Visitors' processors get overloaded by hidden scripts, laptop fans run at full speed.</li>
</ul>
<h3>Symptoms visible in Google Search Console</h3>
<ul>
<li><strong>Security Issues tab</strong> — Google directly notifies you that it found malware or phishing content.</li>
<li><strong>Unexpected pages in the index</strong> — The Coverage report shows thousands of pages you never created, often in foreign languages.</li>
<li><strong>Sudden traffic drop</strong> — Organic traffic drops 50-90% because Google removes your site from search results.</li>
</ul>
<h3>Symptoms visible on the server</h3>
<ul>
<li><strong>Unknown files</strong> — In your hosting control panel (cPanel/Plesk) you see files you didn't upload, especially in upload folders.</li>
<li><strong>Modified system files</strong> — The modification date of key files (<code>index.php</code>, <code>.htaccess</code>) doesn't match your last edit.</li>
<li><strong>High resource usage</strong> — Your host notifies you about CPU or bandwidth overages even though you haven't changed anything.</li>
<li><strong>Emails going to spam</strong> — Your legitimate emails start ending up in recipients' spam folders because your server is on an email blacklist.</li>
</ul>
<div class="callout callout-warn">
<strong>Important:</strong> If you notice any of these symptoms, don't ignore them — the problem will not resolve itself. The longer it remains unaddressed, the more damage you'll suffer: lost visitors, lost reputation, potential legal consequences.
</div>
<h2 id="en-mw3">3. Types of threats site owners face</h2>
<p>Understanding threats helps you know what you're protecting against. Here is an overview of the most common malware types from a site owner's perspective:</p>
<table>
<tr><th>Threat</th><th>What happens to your site</th><th>How you'll notice</th><th>Severity</th></tr>
<tr><td>Backdoor (Webshell)</td><td>Someone has permanent access to your server even after password changes</td><td>Unknown files on server, recurring infections after cleanup</td><td>Critical</td></tr>
<tr><td>SEO Spam</td><td>Google indexes thousands of fake pages on your domain</td><td>Foreign-language pages in Search Console, traffic drop</td><td>High</td></tr>
<tr><td>JavaScript Skimmer</td><td>Visitor data (cards, passwords) is being intercepted</td><td>Customer complaints, unexpected external connections</td><td>Critical</td></tr>
<tr><td>Cryptojacking</td><td>Visitors' CPUs are used to mine cryptocurrency</td><td>Slow site, high visitor CPU usage, fans at maximum</td><td>Medium</td></tr>
<tr><td>Phishing pages</td><td>Fake login forms for banks/services hosted on your domain</td><td>Google warning, notice from hosting provider</td><td>Critical</td></tr>
<tr><td>Spam Relay</td><td>Your server sends thousands of spam emails</td><td>Email blacklisted, hosting warning about overages</td><td>High</td></tr>
<tr><td>Defacement</td><td>Your site is visually altered (political messages, graffiti)</td><td>Immediately visible — your site's content is changed</td><td>Medium</td></tr>
</table>
<div class="callout">
<strong>Most common scenario:</strong> According to Sucuri's report, 73% of all infections involve SEO spam. The owner often notices nothing because fake pages are hidden from regular visitors — only search engine bots see them (a technique known as cloaking). That's why regularly checking your site's Google index is crucial.
</div>
<h2 id="en-mw4">4. Impact on reputation and business</h2>
<p>A malware infection isn't just a technical issue — it's a business crisis that affects multiple areas simultaneously:</p>
<h3>Google blacklist and traffic loss</h3>
<p>When Google Safe Browsing flags your site, all major browsers (Chrome with 65% market share, Firefox, Safari, Edge) display a red screen instead of your content. Research shows that 95% of visitors leave immediately upon seeing this warning — and most never return.</p>
<h3>Email problems</h3>
<p>If your server ends up on email blacklists (Spamhaus, Barracuda, URIBL), your legitimate business emails — proposals, invoices, confirmations — land in clients' spam folders. Even after cleanup, it can take weeks for your domain's reputation to fully recover.</p>
<h3>Loss of customer trust</h3>
<p>If it's discovered that your site served malware or that customer data leaked, that trust is extremely hard to regain. In the era of online reviews, a single security infection can leave a lasting mark on your business reputation.</p>
<h3>Legal consequences</h3>
<p>Under GDPR (Article 32), site owners are obligated to implement "appropriate technical measures" to protect personal data. If an infection is proven to have resulted from neglected security, fines can reach up to 20 million EUR or 4% of global revenue. Serbia's Personal Data Protection Law (ZZPL) has similar provisions.</p>
<h3>Recovery costs</h3>
<p>Professional site cleanup costs between 200 and 1,000+ EUR depending on severity. Add to that lost revenue during downtime, forensic analysis costs, and time to restore reputation — the total cost of an infection often exceeds 5,000 EUR for a small business.</p>
<h2 id="en-mw5">5. Prevention — how to protect your site before anything happens</h2>
<p>Prevention is always cheaper and simpler than recovery. Here are concrete steps every site owner can take:</p>
<h3>Software updates</h3>
<p>Over 50% of all infections come through outdated CMS or plugins. Essential steps:</p>
<ul>
<li>Enable automatic updates for WordPress core, themes, and plugins</li>
<li>Regularly verify you're running the latest PHP version on your server</li>
<li>Delete all inactive plugins and themes — even a deactivated plugin can be vulnerable</li>
<li>Follow security advisories for the software you use (WordPress security mailing list, plugin changelogs)</li>
</ul>
<h3>Strong passwords and two-factor authentication (2FA)</h3>
<ul>
<li>Use passwords of at least 16 characters with a mix of letters, numbers, and special characters</li>
<li>Never reuse the same password across sites — use a password manager (Bitwarden, 1Password)</li>
<li>Enable 2FA for your admin panel, hosting control panel, FTP, and SSH access</li>
<li>Change the default admin username (<code>admin</code>) to something unique</li>
</ul>
<h3>Web Application Firewall (WAF)</h3>
<p>A WAF acts as a protective shield in front of your site, filtering malicious traffic before it reaches your server. Recommended options:</p>
<ul>
<li><strong>Cloudflare</strong> — Free plan with basic WAF protection, paid plans with advanced rules</li>
<li><strong>Sucuri Firewall</strong> — Specialized for WordPress, includes CDN and DDoS protection</li>
<li><strong>Wordfence</strong> — WordPress plugin with built-in firewall and malware scanner</li>
</ul>
<h3>Backup strategy</h3>
<p>Backups won't prevent an attack, but they'll enable fast recovery:</p>
<ul>
<li>Create daily backups (files + database)</li>
<li>Store backups in a <strong>separate location</strong> from the server (cloud storage, local disk)</li>
<li>Keep at least 30 days of backup history — infection may be present weeks before detection</li>
<li>Regularly test the restore procedure — a backup you can't restore is useless</li>
</ul>
<h3>Server security configuration</h3>
<pre><code># .htaccess protection for WordPress upload folder
# Prevents script execution in the uploads directory
<Directory "/var/www/html/wp-content/uploads">
<FilesMatch "\.(php|phtml|php3|php4|php5|pl|py|cgi)$">
Require all denied
</FilesMatch>
</Directory>
# Hide WordPress version
remove_action('wp_head', 'wp_generator');
# Restrict wp-admin access by IP address
<Files wp-login.php>
Require ip 123.456.789.0/24
</Files></code></pre>
<div class="callout">
<strong>Minimum security checklist:</strong> (1) Updated CMS and plugins, (2) Strong passwords + 2FA, (3) WAF enabled, (4) Daily backups in a separate location, (5) Script execution disabled in upload folders. These 5 steps prevent over 90% of attacks.
</div>
<h2 id="en-mw6">6. Regular scanning and monitoring</h2>
<p>Protection isn't a one-time action — it's a continuous process. Regular scanning of your site is the only way to be sure everything is in order.</p>
<h3>What to scan and how often</h3>
<table>
<tr><th>Check</th><th>Frequency</th><th>Tool</th></tr>
<tr><td>External malware scan (frontend analysis)</td><td>Weekly</td><td>Our Malware Scanner, Sucuri SiteCheck</td></tr>
<tr><td>Google Search Console — Security Issues</td><td>Weekly</td><td>Google Search Console (free)</td></tr>
<tr><td>Google index check (<code>site:yourdomain.com</code>)</td><td>Monthly</td><td>Google Search</td></tr>
<tr><td>Blacklist check (DNSBL, Spamhaus)</td><td>Weekly</td><td>Our scanner, MXToolbox</td></tr>
<tr><td>SSL certificate status</td><td>Monthly</td><td>Our scanner, SSL Labs</td></tr>
<tr><td>File integrity on server</td><td>Daily (automated)</td><td>Wordfence, Imunify360, OSSEC</td></tr>
<tr><td>CMS and plugin updates</td><td>Weekly</td><td>WordPress dashboard, hosting panel</td></tr>
</table>
<h3>Automated monitoring services</h3>
<p>For site owners who don't have time for manual weekly checks, there are services that do it automatically and alert you if something is wrong:</p>
<ul>
<li><strong>UptimeRobot</strong> (free) — Checks if your site is online every 5 minutes and notifies you if it goes down</li>
<li><strong>Google Search Console</strong> (free) — Sends email alerts if Google finds a security issue</li>
<li><strong>Wordfence</strong> (free plan) — WordPress plugin that scans files and sends email alerts</li>
<li><strong>Sucuri</strong> (paid) — Continuous monitoring + automatic cleanup if a problem is found</li>
</ul>
<div class="callout callout-warn">
<strong>Don't rely only on Google:</strong> Google Safe Browsing detects about 60-70% of infections, and with a delay of several days. Regular external scanning with a specialized tool catches problems that Google misses or hasn't indexed yet.
</div>
<h2 id="en-mw7">7. Blacklists — what they are and how to get removed</h2>
<p>When your site gets compromised, various security services independently place it on blacklists. This triggers a domino effect affecting multiple aspects of your internet presence.</p>
<h3>Major blacklists and their impact</h3>
<table>
<tr><th>Service</th><th>Impact on you</th><th>How to check</th><th>Removal procedure</th></tr>
<tr><td>Google Safe Browsing</td><td>Red screen in all major browsers</td><td>Google Search Console → Security Issues</td><td>Fix + Review Request (24-72h)</td></tr>
<tr><td>Spamhaus (SBL/XBL)</td><td>Your emails go to spam</td><td>Spamhaus Lookup on their site</td><td>Removal request + proof of cleanup</td></tr>
<tr><td>SURBL / URIBL</td><td>Links to your site blocked in emails</td><td>SURBL Lookup</td><td>Automatic 7-14 days after cleanup</td></tr>
<tr><td>PhishTank</td><td>Browser phishing warnings</td><td>PhishTank search</td><td>Automatic after removing phishing content</td></tr>
<tr><td>URLhaus (abuse.ch)</td><td>Blocked by security tools</td><td>URLhaus search</td><td>Removal request on site</td></tr>
<tr><td>VirusTotal</td><td>Negative rating from 70+ AV vendors</td><td>VirusTotal URL scan</td><td>Rescan after cleanup</td></tr>
</table>
<h3>Google blacklist removal procedure</h3>
<ol>
<li><strong>Clean your site</strong> — Completely remove all malicious content (or hire a professional)</li>
<li><strong>Open Google Search Console</strong> — Go to the Security Issues tab</li>
<li><strong>Mark "I have fixed these issues"</strong> — and submit a Request a Review</li>
<li><strong>Wait 24-72 hours</strong> — Google will re-scan your site and remove the warning if everything is clean</li>
<li><strong>Monitor for the next 30 days</strong> — Check that the problem doesn't return (which signals you didn't close the entry point)</li>
</ol>
<div class="callout">
<strong>Our scanner helps:</strong> The Malware Scanner automatically checks your domain and IP address against Spamhaus, SURBL, URIBL, Barracuda, and 10+ DNSBL lists in real time. A single positive detection means you need to act urgently.
</div>
<h2 id="en-mw8">8. How our scanner helps with detection</h2>
<p>Our Malware Scanner is designed as a tool for site owners who want a quick and free security check. Here's what we verify:</p>
<h3>Safe Scan (no verification — quick check)</h3>
<ul>
<li><strong>HTML analysis</strong> — We check your site's content for known indicators of infection</li>
<li><strong>JavaScript analysis</strong> — We look for suspicious patterns in scripts indicating skimmers or cryptojacking</li>
<li><strong>Hidden iframes</strong> — We detect invisible elements loading external content</li>
<li><strong>Link analysis</strong> — We check all links on your page against URLhaus and OpenPhish known-threat databases</li>
<li><strong>Cookie and tracker check</strong> — We uncover suspicious tracking pixels and unknown cookie domains</li>
</ul>
<h3>Full Scan (requires ownership verification)</h3>
<ul>
<li><strong>DNSBL check</strong> — We check your IP address against 15+ blacklist databases in real time</li>
<li><strong>Index Contamination</strong> — We analyze the Google index for SEO spam (fake pages in foreign languages)</li>
<li><strong>Wayback Machine comparison</strong> — We compare the current site with archived versions to detect unauthorized changes</li>
<li><strong>Reputation Score</strong> — We calculate a reputation score based on domain age, SSL status, and blacklist presence</li>
</ul>
<div class="callout callout-warn">
<strong>Scanner limitations:</strong> We are an external (remote) tool — we analyze what's visible from a browser. We cannot access your server, read databases, or scan your file system. For deep server analysis, use Imunify360, Wordfence, or ClamAV which run directly on your hosting.
</div>
<h2 id="en-mw9">9. Statistics and why this matters</h2>
<p>Website malware isn't a theoretical problem — it's an everyday reality affecting sites of all sizes:</p>
<table>
<tr><th>Metric</th><th>Value</th><th>Source</th></tr>
<tr><td>Sites hacked daily</td><td>30,000+</td><td>Sucuri Annual Report 2024</td></tr>
<tr><td>WordPress infections among CMS platforms</td><td>96.2%</td><td>Sucuri 2024</td></tr>
<tr><td>Most common malware type</td><td>SEO Spam (73%)</td><td>Sucuri Annual Report 2024</td></tr>
<tr><td>Average time to detection</td><td>~90 days</td><td>Sucuri / SiteLock</td></tr>
<tr><td>Recovery costs for small business</td><td>200 — 5,000+ EUR</td><td>Industry average</td></tr>
<tr><td>Visitors who leave after Google warning</td><td>95%</td><td>Google Transparency Report</td></tr>
<tr><td>Estimated global cybercrime damage</td><td>$10.5 trillion/yr</td><td>Cybersecurity Ventures 2025</td></tr>
</table>
<h3>Why small sites are the most common targets</h3>
<p>Large sites have security teams, WAFs, and 24/7 monitoring. Small businesses and personal sites usually have none of that. For attackers, they're easier targets with lower risk — automated tools scan millions of sites looking for outdated software and weak passwords. It's not personal — it's a numbers game.</p>
<div class="callout">
<strong>Good news:</strong> Most attacks are automated and target known vulnerabilities. This means that 5 basic protection steps (updates, strong passwords, 2FA, WAF, backups) protect against over 90% of threats. You don't need to be a security expert — you just need to be a responsible site owner.
</div>
<h2 id="en-mw10">10. References and useful resources</h2>
<ul>
<li><a href="https://sucuri.net/reports/website-threat-report/" target="_blank">Sucuri Annual Website Threat Report</a> — Annual report on website threats</li>
<li><a href="https://www.wordfence.com/threat-intel/" target="_blank">Wordfence Threat Intelligence</a> — WordPress security advisories and vulnerabilities</li>
<li><a href="https://safebrowsing.google.com/" target="_blank">Google Safe Browsing</a> — Check if your site is on Google's blacklist</li>
<li><a href="https://search.google.com/search-console" target="_blank">Google Search Console</a> — Free tool for monitoring your site's security and indexing</li>
<li><a href="https://www.virustotal.com/" target="_blank">VirusTotal</a> — Free URL check through 70+ antivirus engines</li>
<li><a href="https://mxtoolbox.com/blacklists.aspx" target="_blank">MXToolbox Blacklist Check</a> — Check if your domain/IP is on email blacklists</li>
<li><a href="https://www.cloudflare.com/waf/" target="_blank">Cloudflare WAF</a> — Web Application Firewall with a free plan</li>
<li><a href="https://owasp.org/www-project-web-security-testing-guide/" target="_blank">OWASP Web Security Testing Guide</a> — Open guide for security testing</li>
<li><a href="https://developer.mozilla.org/en-US/docs/Web/Security" target="_blank">MDN Web Security</a> — Mozilla's web security guide</li>
</ul>
<a href="./malware.html" class="cta">Scan your site for free →</a>
</div>
<div class="nav-links">
<a href="./blog-security.html"><span class="sr">Bezbednost sajta</span><span class="en">Site Security</span></a>
<a href="./blog-security-headers.html"><span class="sr">HTTP Security Headers</span><span class="en">HTTP Security Headers</span></a>
<a href="./blog-security-malware-recovery.html"><span class="sr">Oporavak hakovanog sajta</span><span class="en">Hacked Site Recovery</span></a>
<a href="./blog-security-ssl.html"><span class="sr">SSL/TLS Sertifikati</span><span class="en">SSL/TLS Certificates</span></a>
<a href="./blog-security-xss.html"><span class="sr">XSS napadi</span><span class="en">XSS Attacks</span></a>
<a href="./blog-security-sql.html"><span class="sr">SQL Injection</span><span class="en">SQL Injection</span></a>
<a href="./blog-security-csrf.html"><span class="sr">CSRF napadi</span><span class="en">CSRF Attacks</span></a>
<a href="./blog-security-dns.html"><span class="sr">DNS bezbednost</span><span class="en">DNS Security</span></a>
</div>
</main>
</div>
<script src="./blog-common.js" defer></script>
</body>
</html>